Water Galura

Executive Summary

Water Galura, also known as GOLD FEATHER, operates a Double extortion Ransomware-as-a-Service (RaaS) model since at least 2024. Primarily targeting sectors including healthcare and financial services across various countries, they demand ransom payments for decryption keys and additional fees to prevent data publication. Their operations leverage T1657 (Financial Theft), T1585.001 (Social Media Accounts), and T1486 (Data Encrypted for Impact) techniques.

Goals & Targeting

Water Galura targets industries with sensitive data, such as healthcare and finance, where the financial stakes are highest. Their geographic reach suggests a global approach, aiming for maximum disruption and payoff. Small businesses and medium-sized enterprises are particularly vulnerable, offering attractive yet defensible assets to extract high-value ransoms.

Water Galura are sophisticated cybercriminal operators of the Qilin RaaS platform, managing payload generation, ransom negotiations, and data leak sites. Since mid-2022, they've recruited affiliates on Russian forums, using double extortion to maximize revenue. Their operations typically involve encrypting victims' data, demanding ransoms for decryption keys, and additional fees to avoid public leaks of stolen information. Water Galura's strategic focus on high-value sectors ensures maximum impact on their targets.

Key Capabilities

• Double extortion tactics via Qilin RaaS
• Recruitment of attack affiliates through cybercrime forums
• Use of social media manipulation for influence
• Advanced financial theft strategies

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Water Galura's campaigns often involve structured attacks on SMEs and critical sectors, using forums to recruit affiliates. Their operations include targeting countries in Eastern Europe and North America, leveraging double extortion for maximum impact, as seen in a late 2024 incident affecting healthcare providers.

IOC Patterns

• Spear-phishing with malicious links leading to Qilin payloads
• Encrypted communication channels for data exfiltration
• Modified RDP protocols for initial access

Recommended Actions

• Implement multi-factor authentication (MFA) for RDP access points
• Conduct regular audits of sensitive business file directories
• Monitor dark web marketplaces for exposed credentials or data dumps
• Run phishing simulations to test user susceptibility
• Ensure offline backups stored securely with immutable storage

Suggested Tags